a7y18lte-ubports/android_kernel_samsung_a7y18lte
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
c985e82f03
android_kernel_samsung_a7y1.../drivers/net
History
qize wang 0091a3e86a mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() 
commit 1e58252e334dc3f3756f424a157d1b7484464c40 upstream.

mwifiex_process_tdls_action_frame() without checking
the incoming tdls infomation element's vality before use it,
this may cause multi heap buffer overflows.

Fix them by putting vality check before use it.

IE is TLV struct, but ht_cap and  ht_oper aren’t TLV struct.
the origin marvell driver code is wrong:

memcpy(&sta_ptr->tdls_cap.ht_oper, pos,....
memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos,...

Fix the bug by changing pos(the address of IE) to
pos+2 ( the address of IE value ).

Signed-off-by: qize wang <wangqize888888888@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Matthias Maennich <maennich@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-07 14:11:57 +02:00
..
appletalk A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
arcnet arcnet: provide a buffer big enough to actually receive packets 2020-04-07 07:37:05 +02:00
bonding bonding/alb: make sure arp header is pulled before accessing it 2020-04-07 14:11:29 +02:00
caif caif-hsi: fix possible deadlock in cfhsi_exit_module() 2020-04-06 20:05:08 +02:00
can can, slip: Protect tty->disc_data in write_wakeup and close with RCU 2020-04-07 13:44:31 +02:00
cris A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
dsa A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ethernet net: fec: validate the new settings in fec_enet_set_coalesce() 2020-04-07 14:11:25 +02:00
fddi A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
fjes fjes: fix missed check in fjes_acpi_add 2020-04-07 13:22:09 +02:00
hamradio 6pack,mkiss: fix possible deadlock 2020-04-07 13:23:56 +02:00
hippi A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
hyperv A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ieee802154 ieee802154: atusb: fix use-after-free at disconnect 2020-04-07 08:07:50 +02:00
ipvlan ipvlan: don't deref eth hdr before checking it's set 2020-04-07 14:11:22 +02:00
irda A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
phy net: phy: restore mdio regs in the iproc mdio driver 2020-04-07 14:04:30 +02:00
plip A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ppp ppp: Adjust indentation into ppp_async_input 2020-04-07 13:50:52 +02:00
slip slip: make slhc_compress() more robust against malicious packets 2020-04-07 14:11:27 +02:00
team team: add missing attribute validation for array index 2020-04-07 14:11:09 +02:00
usb r8152: check disconnect status after long sleep 2020-04-07 14:10:56 +02:00
vmxnet3 A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
wan wan: ixp4xx_hss: fix compile-testing on 64-bit 2020-04-07 13:56:42 +02:00
wimax wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle 2020-04-07 13:36:34 +02:00
wireless mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() 2020-04-07 14:11:57 +02:00
xen-netback xen/netback: fix error path of xenvif_connect_data() 2020-04-07 09:27:06 +02:00
dummy.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
eql.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
geneve.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ifb.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
Kconfig A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
LICENSE.SRC A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
loopback.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
macvlan.c macvlan: add cond_resched() during multicast processing 2020-04-07 14:11:23 +02:00
macvtap.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
Makefile A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
mdio.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
mii.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
netconsole.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
nlmon.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
ntb_netdev.c ntb_netdev: fix sleep time mismatch 2020-04-07 12:36:01 +02:00
rionet.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
sb1000.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
Space.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
sungem_phy.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
tun.c tun: fix use-after-free when register netdev failed 2020-04-06 21:35:29 +02:00
veth.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
virtio_net.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
vrf.c A750FXXU4CTBC 2020-03-27 21:51:54 +05:30
vxlan.c vxlan: fix tos value before xmit 2020-04-07 13:29:18 +02:00
xen-netfront.c xen-netfront: do not use ~0U as error return value for xennet_fill_frags() 2020-04-07 08:07:18 +02:00